Kevin Karhan :verified:<p><span class="h-card" translate="no"><a href="https://grapheneos.social/@GrapheneOS" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>GrapheneOS</span></a></span> Well, you've to ask <a href="https://infosec.space/tags/Google" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Google</span></a> and <a href="https://infosec.space/tags/Fiarphone" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Fiarphone</span></a> that and consider invoking <a href="https://infosec.space/tags/Regulators" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Regulators</span></a> like <span class="h-card" translate="no"><a href="https://ec.social-network.europa.eu/@EUCommission" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>EUCommission</span></a></span>, @kartellamt@social.bund.de and others in that matter.</p><p>Which again proves my point:</p><ol><li><p><a href="https://infosec.space/tags/AllGAFAMsAreEvil" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AllGAFAMsAreEvil</span></a> and <em>NOONE</em> shoud've ever trusted them with anything!</p></li><li><p>The <a href="https://infosec.space/tags/Android" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Android</span></a> ecosystem is fucked up and there is a need for <a href="https://infosec.space/tags/vendors" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>vendors</span></a> to refuse to bow before <a href="https://infosec.space/tags/Google" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Google</span></a> and actually do <a href="https://infosec.space/tags/secure" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>secure</span></a> & <a href="https://infosec.space/tags/repairable" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>repairable</span></a> devices.</p></li></ol> <p>Again: You seem angry at the wromg person if that means you're angry at me.</p><p>The question to me is how is <a href="https://infosec.space/tags/GrapheneOS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>GrapheneOS</span></a> gonna go about this? </p><ul><li>Cuz we both know Google can afford to go <em>"maximum asshole"</em> on you [the Grpahnene OS Project] and even in the worst case their legal department won't even notice this whole shitshow even if miraculously by the wounders of everyone from <span class="h-card" translate="no"><a href="https://mastodon.social/@eff" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>eff</span></a></span> to <span class="h-card" translate="no"><a href="https://hostux.social/@fsf" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>fsf</span></a></span> to <span class="h-card" translate="no"><a href="https://mastodon.social/@noybeu" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>noybeu</span></a></span> and <span class="h-card" translate="no"><a href="https://social.bau-ha.us/@CCC" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>CCC</span></a></span> forcing Google to literally support and endore GrapheneOS, because by the time any binding court ruling would be enforced, Google would've choked the project out of the market.</li></ul> <p>So my question is <em>when</em> will you get forward and work with other <a href="https://infosec.space/tags/vendors" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>vendors</span></a> instead of tying your project to Google-specific and thus sorta-proprietary implementations?</p><p><code>[...] Pixel targets have a lot of device-specific hardening in the AOSP base along with some in GrapheneOS which needs to be ported over too. For example, various security features in the kernel including type-based Control Flow Integrity (CFI) and the shadow call stack are currently specific to the kernels for these devices. [...]</code></p><ul><li><a href="https://grapheneos.org/build#building-grapheneos" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">grapheneos.org/build#building-</span><span class="invisible">grapheneos</span></a></li></ul><p>To me that sounds like some very serious <a href="https://infosec.space/tags/VendorLockIn" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>VendorLockIn</span></a> you're stuck in, and now it bites you in your rear...</p><p>I hate to say it, but <a href="https://infosec.space/tags/ToldYaSo" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ToldYaSo</span></a> sadly happened!</p><p>I guess you gotta have to <a href="http://landley.net/toybox/" rel="nofollow noopener" target="_blank">bootstrap it from scratch</a> starting with <a href="https://infosec.space/tags/toybox" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>toybox</span></a> + musl / <a href="https://infosec.space/tags/linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>linux</span></a> sooner or later...</p> <p>Not to seem like an asshole, but I do sincerely wish GrpaheneOS and it's team only the best of luck and that the issue gets fixed sooner than later, because this <a href="https://infosec.space/tags/Vendor" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Vendor</span></a> <a href="https://infosec.space/tags/LockIn" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>LockIn</span></a> is a major issue [and yes I do blame the Device Vendors that shit out unmaintained garbage] so unless you can afford the legal cost of actuall enforcing <a href="https://infosec.space/tags/EU" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EU</span></a> laws re: <a href="https://infosec.space/tags/SecurityUpdates" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SecurityUpdates</span></a> and force Vendors like <a href="https://infosec.space/tags/Fairphone" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Fairphone</span></a> to actually follow their claims re: <a href="https://infosec.space/tags/Security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Security</span></a> and <a href="https://infosec.space/tags/Updates" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Updates</span></a>, this won't move anywhere.</p><ul><li>Yes I know you don't have that money and I don't expect this to be the case! </li></ul><p>I do however also don't expect you to find a magical solution. My point is that there needs to be a change of strategy, and relying on Hardware you neither <em>own</em> nor <em>control</em> in the sense of Stakeholding isn't going to provide you with the necessary stability.</p><ul><li>Because Google is a [pulicly traded] <a href="https://infosec.space/tags/Corporation" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Corporation</span></a> and Corporations are explicity nobody's friend!</li></ul>